suportt-app---ledgre[.]webflow[.]io

This domain, suportt-app---ledgre.webflow.io, is flagged as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live login interface, presenting a page titled "Ledger® Live* : Login | Most Secure Crypto Wallet (webflow)" to deceive users into submitting sensitive credentials or recovery phrases. No explicit drainer kit signatures were identified, but the infrastructure aligns with credential harvesting tactics commonly used in crypto-phishing campaigns. Infrastructure analysis reveals the domain was created on March 03, 2026, and is hosted on Webflow’s platform. It resolves to the IP address 172.64.151.8, geolocated to the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1). Security telemetry shows 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to takedown. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the infrastructure or migration of the phishing kit to new domains. Users who interacted with the site should assume credential exposure and take corrective actions, such as revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and related indicators to prevent future access attempts.